netfilter: ctnetlink: make it safer when updating ct->status